When using the withCredentials( … ) { … } step of a Pipeline, credential variables' values printed (by referencing or echoing these variable values) within the step’s block are typically masked with “****” values in the console output or Jenkins log. This is done to protect the secrecy of these credentials.
If, however, such variables' values were printed outside a withCredentials( … ) { … } Pipeline block, the variables' values would be exposed (unmasked) in the console output or Jenkins log. This grants users of your CloudBees CI controllers who are not authorized to access such credentials (other than through the scope of a CloudBees CI Pipeline) clear visibility of these credential values.
The enhanced credentials masking feature (provided by the Enhanced Credentials Masking plugin) is used to mask credential variables and values used outside of withCredentials( … ) { … } Pipeline blocks, thereby maintaining the security and secrecy of such credentials.
To activate this feature on the controller, install the CloudBees Enhanced Credentials Masking plugin. Once the plugin is installed, the enhanced credentials masking feature is enabled by default.
| To disable this setting, navigate to and clear Enable extended masking of credentials, and then select Save. |